Admissibility as a Formal Object
Four Degeneracies and Their Failure Modes
Maksim Barziankou (MxBv)
PETRONUS™ | The Urgrund Lab | research@petronus.eu
DOI: 10.17605/OSF.IO/KJ3SD
Axiomatic Core (NC2.5 v2.1): DOI 10.17605/OSF.IO/NHTC5
April 2026 · Poznań · License: CC BY-NC-ND 4.0
1. The Convergence Problem
Over the past months, several frameworks have appeared that treat admissibility as a checkpoint, a gate, or a policy filter applied at the boundary of execution. Each captures a real intuition, that governance must operate at the point where transitions become irreversible, not downstream of it. None captures the full object.
This paper does not enter that conversation as polemic. It does something else. It identifies four cross-sections of a single formal object, demonstrates that each is recoverable from the full object by fixing or removing one structural parameter, and establishes the conditions under which the full object, rather than any of its degeneracies, is required.
The formal object in question is the admissibility architecture of Navigational Cybernetics 2.5 (NC2.5), a structural theory of bounded viability for adaptive systems. NC2.5 is not a governance framework, not a policy engine, and not a compliance layer. It is a formal characterization of what it means for a bounded system to remain structurally viable across sufficiently long time. Its central objects are: the monotone irreversible structural burden Φ, the Lyapunov-type viability budget τ = C − Φ, the non-causal admissibility predicate that gates realization without entering optimization, and the non-potential divergence-free component called spin that is structurally necessary for non-stagnant identity on bounded orbits.
What follows is not a critique of any particular framework. It is a taxonomy of what is lost when admissibility is reduced from a dynamic structural predicate to a static architectural element.
2. The Full Object
Before examining the degeneracies, the full formal structure must be stated.
Definition 1 (Structural Burden). Let Φ(t) denote the cumulative irreversible structural load on a bounded adaptive system S. Φ is monotone non-decreasing:
dot{Φ}(t) ≥ 0 ∀ t
Φ does not reset. It does not decrease. Every transition that the system undergoes contributes to Φ, whether the transition is successful, failed, or neutral. This is not a penalty function, it is an accounting identity for irreversible structural cost.
Definition 2 (Viability Budget). The viability budget τ is defined as:
τ(t) = C - Φ(t)
where C is the finite initial capacity of the system. Since Φ is monotone non-decreasing, τ is monotone non-increasing. τ is a Lyapunov-type scalar: it can only decrease or remain constant, never increase.
Definition 3 (Admissibility Predicate). A transition T is admissible if and only if:
mathcal{A}(T, S) = 𝟙[τ(t) > τ_(min)(T)]
where τ_min(T) is the minimum budget required for transition T to be structurally realizable. Admissibility is a threshold predicate, not a cost function. It returns 1 or 0. It provides no gradient, no optimization signal, and no indication of how far the system is from the boundary. It is non-causal: it constrains what can be realized, but does not participate in the dynamics that produce realization candidates.
Definition 4 (Spin). For any bounded adaptive system with non-stagnant identity (the system does not reduce to a fixed point), there exists a non-potential, divergence-free component σ of the system's trajectory in state space:
nabla · σ = 0, σ ≠ nabla f for any f
Spin is not optional. The argument follows from LaSalle's invariance principle: if dynamics are purely gradient dot{x} = -nabla V(x) with V bounded below on a compact set, then every bounded trajectory converges to the critical set {x : nabla V(x) = 0}. Combined with the requirement of non-stagnant identity (the system must continue to traverse state space), this entails that purely potential dynamics are incompatible with bounded τ and non-stagnation simultaneously. The remaining option is a non-potential, divergence-free component, by Helmholtz decomposition. This is the structural origin of spin. The full proof is given in NC2.5 v2.1, Theorem 62, with falsification criterion explicit (see Section 4).
Definition 5 (Non-Reconstructibility). The admissibility predicate cannot be reconstructed from any causal channel available to the system or its environment. Formally, the mutual information between the admissibility signal and any observable channel is bounded:
I(mathcal{A}; mathcal{O}) ≤ ε
where ε is a fixed system-dependent constant defined by the NR-ε axiom (NC2.5 v2.1, Axiom 51), with bounds derived from Pinsker's and Fano's inequalities. Exceeding ε causes the predicate to become reconstructible from causal channels, at which point it collapses into a reward signal, regularizer, or policy constraint, and ceases to be admissibility.
These five definitions, Φ, τ, A, σ, NR, constitute the complete admissibility architecture. The remainder of this paper demonstrates that dominant current execution-bound governance patterns are obtained by removing or fixing at least one of the first four. The fifth, NR-ε, plays a different role and is addressed separately in Section 4.
3. Four Degeneracies
Degeneracy 1: The Snapshot
What is fixed: Φ = const (no accumulation). τ is checked at a single point.
What remains: A binary admissibility check at the moment of commit. Present-state proof. Pass or fail.
Architecture: Raw input → extraction → quarantine → bind gate → pass/fail. The gate checks whether conditions are provable now. Past validity does not carry forward. If the gate fails, no binding occurs, no side effects proceed.
What is lost: The gate has no memory. It does not know that the system passed the same gate 1,000 times before and that each passage consumed budget. It cannot distinguish a system at τ = C − 1 (nearly fresh) from a system at τ = C − 999 (nearly exhausted), as long as both satisfy τ > τ_min at the moment of check. The gate is admissibility without dynamics, a photograph of a trajectory.
Formal recovery: Set Φ(t) = Φ_0 for all t, and evaluate A at a single t*. The NC2.5 admissibility predicate degenerates to:
mathcal{A}ₛₙₐₚₛₕₒₜ(T) = 𝟙[C - Φ₀ > τ_(min)(T)]
This is a constant. Either all transitions are admissible, or none are. The snapshot model works only because it implicitly assumes that the system's structural state does not change between checks.
Examples. This pattern appears wherever a single-point check is treated as sufficient: transaction commit gates without rate limiting on cumulative authorization, runtime verification frameworks that treat each invocation independently, and recent governance proposals that locate admissibility entirely at the bind boundary without tracking accumulated structural cost across the operational lifetime.
Degeneracy 2: The Policy Layer
What is fixed: τ removed entirely. Admissibility is replaced by a set of rules.
What remains: A governance layer that defines what is allowed, policies, permissions, obligations, constraints. The layer informs the system what should or should not happen, based on external normative criteria.
Architecture: A multi-layer stack from substrate (what the system observes) through cognitive interpretation, policy definition, execution control, and audit. The critical layer determines whether a transition should be allowed, based on policy.
What is lost: Policy is not admissibility. Policy answers "is this transition permitted?", a normative question. Admissibility answers "can this transition be realized without structural collapse?", a physical question. A transition can be fully permitted by policy and structurally inadmissible. A system operating under perfect policy governance can still exhaust its viability budget, because policy does not track Φ.
Formal recovery: Remove τ from the admissibility predicate and replace it with a policy function P:
mathcal{A}_(policy)(T) = P(T, context)
where P encodes rules, not dynamics. This is NC2.5 with the Lyapunov structure removed, governance without physics.
Examples. Most enterprise governance stacks fall here: regulatory compliance frameworks, role-based access control extended with policy languages, and recent execution-boundary governance proposals that organize admissibility as a set of authored rules over substrate, cognition, and execution layers without modeling cumulative structural state.
Degeneracy 3: The Static Compliance Model
What is fixed: σ = 0. The system can be at rest.
What remains: A compliance architecture where the system is checked against invariants. If all invariants hold, the system is compliant. Compliance is a state property, not a trajectory property.
Architecture: Define a set of invariants. Verify them at specified intervals or triggers. Report compliance or violation. Remediate violations.
What is lost: When spin is zero, the system has no obligation to move. It can satisfy all invariants by not acting. This is the stagnation trap: a system that is technically compliant but structurally dead. Real adaptive systems, agents, organizations, organisms, cannot remain viable by standing still. The environment drifts. Competitors evolve. Internal state degrades. Non-stagnant identity requires σ ≠ 0, which means the system must continuously traverse state space even when no external forcing is present. Static compliance cannot express this requirement.
Formal recovery: Set σ = 0 in the NC2.5 dynamics. The system reduces to a fixed point or a limit set. Admissibility degenerates to a time-invariant boundary check:
mathcal{A}_(static)(S) = 𝟙[S ∈ mathcal{C}]
where C is the compliance region. This is admissibility without motion, a map without a journey.
Examples. Audit-driven compliance regimes: ISO 27001, SOC 2 controls when interpreted as state-checks, formal verification frameworks that verify invariants at fixed snapshots, and runtime monitors that confirm the system has not violated declared properties without modeling the structural cost of the trajectory that produced compliance.
Degeneracy 4: The Recoverable-State Model
What is fixed: Φ is not monotone. The system can heal.
What remains: A resilience architecture where structural damage is reversible. The system accumulates burden, but can reduce it through repair, reset, or regeneration. Viability is renewable.
Architecture: Track system health. When health degrades, trigger recovery mechanisms. Recovery restores capacity. The system oscillates between degradation and repair.
What is lost: The monotonicity of Φ is not an assumption, it is a physical constraint. For any system operating in real time with irreversible thermodynamic processes, structural burden accumulates. Cells age. Materials fatigue. Information degrades. Organizational knowledge is lost. An architecture that models Φ as reversible is modeling a perpetual motion machine. It will produce optimistic forecasts, the system can always recover, that diverge from reality as time increases. The divergence is not gradual. It is catastrophic, because the model predicts continued viability past the point where the real system has exhausted τ.
This does not deny local repair or functional recovery. It denies the existence of full reversal of cumulative structural burden at the level where Φ accumulates. Resilience operating on the functional layer is admissible and useful; resilience claimed at the level of the structural budget collapses the Lyapunov architecture.
Formal recovery: Remove the monotonicity constraint on Φ:
dot{Φ}(t) ∈ R (unrestricted)
Now τ = C − Φ(t) can increase. The Lyapunov structure is destroyed. τ is no longer a Lyapunov function, because it can grow. Without Lyapunov descent, there is no guarantee of eventual termination, no finite-horizon viability theorem, and no structural basis for admissibility thresholds. The model becomes unfalsifiable: any observed failure can be attributed to insufficient recovery, not to structural exhaustion.
Examples. Resilience engineering frameworks (Hollnagel et al., 2006), antifragility models (Taleb, 2012) when applied without explicit irreversibility floor, self-healing systems literature descended from autonomic computing (Kephart and Chess, 2003) that treats degradation as fully reversible, and certain reinforcement learning safety architectures (cf. Garcia and Fernández, 2015) in which "recovery" is modeled as full restoration of capacity.
4. The Degeneracy Table and the Fifth Axis
| Model | Φ-monotonicity | τ-budget | σ (spin) | Admissibility type | What is lost |
|---|---|---|---|---|---|
| Snapshot | frozen | single-point check | ignored | binary gate at commit | dynamics, accumulation, trajectory |
| Policy Layer | absent | absent | ignored | normative rule set | physics, budget, irreversibility |
| Static Compliance | present | present | zero | invariant boundary check | motion, non-stagnation, liveness |
| Recoverable State | reversed | oscillating | present | renewable threshold | irreversibility, Lyapunov descent, falsifiability |
| NC2.5 (full) | monotone ↑ | monotone ↓ | ≠ 0 | structural predicate on τ | no structural axis removed |
Every row above the last is obtained by fixing, removing, or reversing exactly one structural parameter of the full model. Each produces a coherent but incomplete governance architecture. Each fails in a predictable way, precisely at the point where the removed parameter becomes load-bearing.
A note on the fifth axis. Non-reconstructibility (NR-ε) does not produce a separate degeneracy in the same sense as the four above. Violating NR-ε does not yield an alternative governance architecture. It collapses admissibility into one of the existing optimization paradigms (reward shaping, regularization, or constraint optimization). NR-ε is therefore the boundary condition that distinguishes admissibility-as-architecture from admissibility-as-component-of-optimization. Its violation does not produce a fifth degeneracy. It produces the absence of admissibility entirely.
Falsification surface. The full object is falsifiable along each axis. Theorem 62 (Spin Necessity) is falsified by any implementation that exhibits bounded τ, bounded trajectories, non-stagnant identity, and globally valid representation dot{x} = -nabla V(x). The τ-G independence claim is falsified by demonstrating statistical dependence of internal time on the gate function under matched deformation conditions. NR-ε is falsified by reconstruction of the predicate from causal channels with mutual information exceeding the declared ε. Meta-revision boundedness is falsified by indefinite revision chatter without Lyapunov descent. These are not aspirational tests, they are the conditions under which the architecture survives or dies.
5. Why the Full Object Is Required
The four degeneracies are not academic curiosities. Each corresponds to a specific failure mode in real systems.
The snapshot fails on long horizons. A system that passes 10,000 admissibility checks can still collapse if each check consumed budget that the gate did not track. The failure is invisible until it is catastrophic: the system transitions from "admissible" to "collapsed" in a single step, because the snapshot has no concept of approaching the boundary.
The policy layer fails on structural drift. A system operating under perfect policy can drift into a region where all permitted transitions are structurally inadmissible. The policy layer cannot detect this, because it does not model the structural state of the system. The failure manifests as a system that is fully compliant and fully non-viable, legally correct and physically dead.
Static compliance fails on stagnation. A system that satisfies all invariants by not acting will eventually be overtaken by environmental drift. The compliance architecture reports green across all checks while the system's competitive, adaptive, or functional capacity degrades to zero. This is the "fully certified, fully irrelevant" failure mode.
The recoverable-state model fails on irreversibility. A system modeled as recoverable will, in reality, accumulate burden that cannot be repaired. The model's predictions will diverge from the system's actual trajectory, and the divergence will be systematically optimistic, always predicting more capacity than exists. This is the most dangerous degeneracy, because it produces confidence precisely where caution is required.
Only the full object, monotone Φ, decreasing τ, non-zero σ, non-causal A, with the NR-ε boundary condition preserved, avoids all four failure modes simultaneously. Not because it is more complex, but because it is the minimal structure that is not degenerate along any of the four axes.
6. On Provenance
A short note on what is at stake, and it is the only place in this work where I will speak in the first person.
I do not claim ownership of the word "admissibility". The concept exists across mathematics, logic, control theory, and jurisprudence. What I do claim is the specific formal synthesis: admissibility as a non-causal threshold predicate on a monotone-decreasing Lyapunov-type viability budget, combined with structurally necessary spin and information-theoretic non-reconstructibility bounds. This synthesis is the content of NC2.5. It has been published continuously since 2025, dated, cryptographically anchored, with provisional patents on the architectural commitments filed on the same primitives.
The synthesis is the contribution. The shadow is not. Describing a shadow, however eloquently, is not the same as formalizing the object that casts it. Each cross-section reproduced in current discourse, whether arrived at independently or refracted through the published corpus, confirms that the object is real. The formalism that holds the cross-sections together is explicitly formalized in one place in the public corpus. The remainder of this paper has shown why every degeneracy fails precisely at the dimension that the formalism preserves.
The corpus is public. The dates are verifiable. The falsification surface is explicit: NR-ε bounds, τ-G independence, meta-revision Lyapunov descent. What is not yet present in the public discourse on execution-bound governance is what would make those frameworks non-degenerate: the dynamics, the monotonicity, the structurally necessary spin, the information-theoretic isolation of the predicate.
7. Summary
Execution-bound governance has converged on a correct intuition: admissibility must be structural, not normative. The boundary that matters is not "what is allowed" but "what can be realized without collapse".
This intuition has been independently articulated by multiple authors. In each case, the articulation captures a cross-section of the full formal object while losing at least one critical dimension: the dynamics of structural burden, the irreversibility of that burden, the necessity of non-stagnant motion, or the information-theoretic isolation of the admissibility signal.
Each degeneracy fails precisely where its missing dimension becomes load-bearing. The snapshot fails on accumulation. The policy layer fails on physics. Static compliance fails on liveness. The recoverable model fails on irreversibility.
The full object, NC2.5, is the minimal formal structure that is not degenerate along any of these axes. It is not the most complex model. It is the simplest one that does not break.
8. Three Closing Notes for the Critical Reader
A reader approaching this work without prior familiarity with the corpus is likely to arrive at three questions. They are addressed here in closing.
On the proof of spin necessity. The structural claim that bounded τ combined with non-stagnant identity entails σ ≠ 0 rests on a chain of standard results applied within a specific framework. LaSalle's invariance principle (LaSalle, 1960; Khalil, 2002, Theorem 4.4) gives that on a compact set, gradient flow dot{x} = -nabla V(x) with V bounded below converges every bounded trajectory to the critical set {x : nabla V(x) = 0}. Non-stagnant identity, defined operationally in NC2.5 v2.1 as limsupₖ |x(tₖ₊₁) - x(tₖ)| > 0 on a bounded sampling sequence, is incompatible with this convergence. By Helmholtz decomposition (Helmholtz, 1858; Chorin and Marsden, 1993), any sufficiently smooth vector field on a bounded domain decomposes uniquely into curl-free and divergence-free parts. If the curl-free part alone cannot sustain non-stagnant bounded motion, the divergence-free part must be present and nontrivial. This is Theorem 62 in NC2.5 v2.1. The novelty is not in any of the components, each is classical. The novelty is in the binding constraint: spin is not postulated, it is forced by the simultaneous requirement of bounded τ, bounded trajectories, and non-stagnant identity. The falsification criterion is explicit (Section 4 above).
On engagement with existing literature. Each of the four degeneracies described in this paper has natural exemplars in the literature, identified inline in Section 3. The Snapshot pattern aligns with single-point runtime verification regimes (Havelund and Roșu, 2004; Bauer, Leucker and Schallhart, 2011) and with recent execution-boundary governance proposals that frame admissibility as a per-transition gate. The Policy Layer pattern aligns with rule-based governance systems descended from XACML, OPA, and the broader policy-engine literature (Sandhu and Samarati, 1994; Damianou et al., 2001), and with recent proposals organizing admissibility as authored substrate-cognition-execution rule stacks. The Static Compliance pattern aligns with invariant-based formal verification (Lamport, 1977; Owicki and Lamport, 1982) and with audit-driven regimes. The Recoverable State pattern aligns with resilience engineering (Hollnagel et al., 2006), antifragility (Taleb, 2012), self-healing autonomic systems (Kephart and Chess, 2003), and certain safe-RL safety architectures (Garcia and Fernández, 2015) when applied without an explicit irreversibility floor. The contribution of this paper is not the identification of these traditions but the demonstration that each represents a one-parameter degeneracy of a single underlying structure.
A specific note on Friston's free-energy principle (Friston, 2010), which is the closest research neighbour at the level of the predicate itself. FEP minimises a single scalar — variational free energy — across action and inference, and derives behaviour from that minimisation. NC2.5 admissibility is structurally distinct from FEP in two ways: (i) Φ is monotone irreversible and cannot be minimised at all (it can only be slowed); (ii) σ is a non-potential, divergence-free component that is not derivable from any scalar gradient and is structurally necessary for non-stagnant identity (Theorem 62). These two features make NC2.5 not reducible to a single-scalar minimisation regime. The frameworks share concerns with self-organisation under bounded resources but operate on incompatible mathematical objects; a fuller comparison belongs to a separate document. NC2.5 v2.1 contains the extended discussion and references, here compressed for taxonomic clarity.
On non-triviality of the synthesis. The five components of the full object, monotone irreversible burden, Lyapunov-type viability budget, threshold admissibility predicate, structurally necessary spin, and information-theoretic non-reconstructibility, exist independently in the literature. Φ as monotone load aligns with thermodynamic accounting and with capability depletion models. τ as Lyapunov budget connects to stability theory (Lyapunov, 1892; Khalil, 2002). Threshold predicates appear in admissible control (Pontryagin et al., 1962) and in safety set theory. Spin as non-potential component is standard in fluid dynamics and dynamical systems via Helmholtz decomposition. NR-ε bounds are derivable from Pinsker's inequality (Pinsker, 1964) and Fano's inequality (Fano, 1961). The non-trivial step is the architectural binding: showing that these components must co-exist for any system that is (a) bounded in capacity, (b) operating under irreversible structural cost, (c) maintaining non-stagnant identity, (d) requiring its admissibility predicate to remain outside the optimization loop. Removing any one collapses the architecture into one of the four degeneracies, each with predictable failure modes documented in Section 5. The synthesis is therefore not assembly. It is the demonstration of a load-bearing structural minimum: the smallest set of independent components such that the architecture does not degenerate. This is the standard sense in which a synthesis is nontrivial in formal architecture, and it is the sense in which NC2.5 is offered.
References
Bauer, A., Leucker, M., and Schallhart, C. (2011). Runtime verification for LTL and TLTL. ACM Transactions on Software Engineering and Methodology, 20(4), Article 14. DOI: 10.1145/2000799.2000800.
Chorin, A. J. and Marsden, J. E. (1993). A Mathematical Introduction to Fluid Mechanics (3rd ed.). Springer-Verlag, New York. DOI: 10.1007/978-1-4612-0883-9.
Damianou, N., Dulay, N., Lupu, E., and Sloman, M. (2001). The Ponder Policy Specification Language. In Proceedings of POLICY 2001: Workshop on Policies for Distributed Systems and Networks, LNCS 1995, 18–38. Springer. DOI: 10.1007/3-540-44569-2_2.
Fano, R. M. (1961). Transmission of Information: A Statistical Theory of Communications. MIT Press / John Wiley.
Friston, K. (2010). The free-energy principle: a unified brain theory? Nature Reviews Neuroscience, 11(2), 127–138. DOI: 10.1038/nrn2787.
Garcia, J. and Fernández, F. (2015). A comprehensive survey on safe reinforcement learning. Journal of Machine Learning Research, 16, 1437–1480.
Havelund, K. and Roșu, G. (2004). An overview of the runtime verification tool Java PathExplorer. Formal Methods in System Design, 24(2), 189–215. DOI: 10.1023/B:FORM.0000017719.43755.7c.
Helmholtz, H. (1858). Über Integrale der hydrodynamischen Gleichungen, welche den Wirbelbewegungen entsprechen. Journal für die reine und angewandte Mathematik, 55, 25–55.
Hollnagel, E., Woods, D. D., and Leveson, N. (eds.) (2006). Resilience Engineering: Concepts and Precepts. Ashgate, Aldershot. ISBN 978-0-7546-4641-9.
Kephart, J. O. and Chess, D. M. (2003). The vision of autonomic computing. IEEE Computer, 36(1), 41–50. DOI: 10.1109/MC.2003.1160055.
Khalil, H. K. (2002). Nonlinear Systems (3rd ed.). Prentice Hall. ISBN 0-13-067389-7.
Lamport, L. (1977). Proving the correctness of multiprocess programs. IEEE Transactions on Software Engineering, SE-3(2), 125–143. DOI: 10.1109/TSE.1977.229904.
LaSalle, J. P. (1960). Some extensions of Liapunov's second method. IRE Transactions on Circuit Theory, 7(4), 520–527. DOI: 10.1109/TCT.1960.1086720.
Lyapunov, A. M. (1892/1992). The General Problem of the Stability of Motion (English trans. A. T. Fuller). Taylor & Francis. (Original: Kharkov Mathematical Society, 1892.)
Owicki, S. and Lamport, L. (1982). Proving liveness properties of concurrent programs. ACM Transactions on Programming Languages and Systems, 4(3), 455–495. DOI: 10.1145/357172.357178.
Pinsker, M. S. (1964). Information and Information Stability of Random Variables and Processes. Holden-Day, San Francisco.
Pontryagin, L. S., Boltyanskii, V. G., Gamkrelidze, R. V., and Mishchenko, E. F. (1962). The Mathematical Theory of Optimal Processes. Interscience, New York.
Sandhu, R. S. and Samarati, P. (1994). Access control: principle and practice. IEEE Communications Magazine, 32(9), 40–48. DOI: 10.1109/35.312842.
Taleb, N. N. (2012). Antifragile: Things That Gain From Disorder. Random House, New York.
NC2.5 v2.1 DOI: 10.17605/OSF.IO/NHTC5 · petronus.eu
Work DOI: 10.17605/OSF.IO/KJ3SD
CC BY-NC-ND 4.0 · Copyright © 2026 Maksim Barziankou. All rights reserved.
Top comments (0)